Splunk Search

How to search average response + total application count for last 6 months with span of 1 month

ngaviran
New Member

I am trying to query and not able to get the output , only i am getting host names, Avg response , count , but need Span of 1 month also in the output .

below is the search queary where i expecting month on month column output also ...
sourcetype="ats_request" host!=dc* | stats avg(duration) as "Average App Response Time" count(sourcetype) as "Total Count" by host

Tags (1)
0 Karma

kmaron
Motivator

Try this

sourcetype="ats_request" host!=dc* 
| bucket _time span=1mon
| stats avg(duration) as "Average App Response Time" count(sourcetype) as "Total Count" by host _time
0 Karma

ngaviran
New Member

Thanks a lot, it works for me @kmaron

0 Karma

kmaron
Motivator

Since it worked for you please accept my answer so others know your question was answered.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...